32 if (
Message.LoadStringW(MessageId))
134 WCHAR FilterName[128] = { 0 };
135 WCHAR NumOfInstances[16] = { 0 };
137 WCHAR Frame[16] = { 0 };
141 PFILTER_AGGREGATE_STANDARD_INFORMATION FilterAggInfo;
142 FilterAggInfo = (PFILTER_AGGREGATE_STANDARD_INFORMATION)
Buffer;
144 if (FilterAggInfo->Flags & FLTFL_ASI_IS_MINIFILTER)
146 if (FilterAggInfo->Type.MiniFilter.FilterNameLength < 128)
149 (
PCHAR)FilterAggInfo + FilterAggInfo->Type.MiniFilter.FilterNameBufferOffset,
150 FilterAggInfo->Type.MiniFilter.FilterNameLength);
151 FilterName[FilterAggInfo->Type.MiniFilter.FilterNameLength] =
UNICODE_NULL;
154 StringCchPrintfW(NumOfInstances, 16,
L"%lu", FilterAggInfo->Type.MiniFilter.NumberOfInstances);
156 if (FilterAggInfo->Type.MiniFilter.FilterAltitudeLength < 64)
159 (
PCHAR)FilterAggInfo + FilterAggInfo->Type.MiniFilter.FilterAltitudeBufferOffset,
160 FilterAggInfo->Type.MiniFilter.FilterAltitudeLength);
161 FilterName[FilterAggInfo->Type.MiniFilter.FilterAltitudeLength] =
UNICODE_NULL;
166 else if (FilterAggInfo->Flags & FLTFL_ASI_IS_LEGACYFILTER)
168 if (FilterAggInfo->Type.LegacyFilter.FilterNameLength < 128)
171 (
PCHAR)FilterAggInfo + FilterAggInfo->Type.LegacyFilter.FilterNameBufferOffset,
172 FilterAggInfo->Type.LegacyFilter.FilterNameLength);
173 FilterName[FilterAggInfo->Type.LegacyFilter.FilterNameLength] =
UNICODE_NULL;
187 PFILTER_FULL_INFORMATION FilterInfo;
188 FilterInfo = (PFILTER_FULL_INFORMATION)
Buffer;
190 if (FilterInfo->FilterNameLength < 128)
193 FilterInfo->FilterNameBuffer,
194 FilterInfo->FilterNameLength);
195 FilterName[FilterInfo->FilterNameLength] =
UNICODE_NULL;
200 FilterInfo->NumberOfInstances,
201 FilterInfo->FrameID);
208 PFILTER_VOLUME_STANDARD_INFORMATION FilterVolInfo;
210 WCHAR VolName[128] = { 0 };
213 FilterVolInfo = (PFILTER_VOLUME_STANDARD_INFORMATION)
Buffer;
215 if (FilterVolInfo->FilterVolumeNameLength < 128)
218 (
PCHAR)FilterVolInfo->FilterVolumeName,
219 FilterVolInfo->FilterVolumeNameLength);
220 VolName[FilterVolInfo->FilterVolumeNameLength] =
UNICODE_NULL;
226 switch (FilterVolInfo->FileSystemType)
232 case FLT_FSTYPE_NTFS:
240 case FLT_FSTYPE_EXFAT:
244 case FLT_FSTYPE_NPFS:
248 case FLT_FSTYPE_MSFS:
252 case FLT_FSTYPE_UNKNOWN:
298 wprintf(
L"------------------------------ ------------- ------------ -----\n");
303 wprintf(
L"------------------------------ ------------- -----\n");
311 IsNewStyle ? FilterAggregateStandardInformation : FilterFullInformation,
350 wprintf(
L"------------------------------ --------------------------------------- ---------- --------\n");
357 FilterVolumeStandardInformation,
407 wprintf(
L"fltmc.exe load [name]\n\n");
419 wprintf(
L"fltmc.exe unload [name]\n\n");
#define IDS_DISPLAY_FILTERS2
#define IDS_ERROR_VOLUMES
#define IDS_USAGE_VOLUMES
#define IDS_USAGE_FILTERS
#define IDS_DISPLAY_FILTERS1
#define IDS_DISPLAY_VOLUMES
#define IDS_ERROR_FILTERS
BOOL WINAPI LookupPrivilegeValueW(LPCWSTR lpSystemName, LPCWSTR lpPrivilegeName, PLUID lpLuid)
BOOL WINAPI AdjustTokenPrivileges(HANDLE TokenHandle, BOOL DisableAllPrivileges, PTOKEN_PRIVILEGES NewState, DWORD BufferLength, PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength)
BOOL WINAPI OpenProcessToken(HANDLE ProcessHandle, DWORD DesiredAccess, PHANDLE TokenHandle)
#define GetCurrentProcess()
#define ERROR_NO_MORE_ITEMS
_Must_inspect_result_ HRESULT WINAPI FilterFindNext(_In_ HANDLE hFilterFind, _In_ FILTER_INFORMATION_CLASS dwInformationClass, _Out_writes_bytes_to_(dwBufferSize, *lpBytesReturned) LPVOID lpBuffer, _In_ DWORD dwBufferSize, _Out_ LPDWORD lpBytesReturned)
_Must_inspect_result_ HRESULT WINAPI FilterVolumeFindFirst(_In_ FILTER_VOLUME_INFORMATION_CLASS dwInformationClass, _Out_writes_bytes_to_(dwBufferSize, *lpBytesReturned) LPVOID lpBuffer, _In_ DWORD dwBufferSize, _Out_ LPDWORD lpBytesReturned, _Out_ PHANDLE lpVolumeFind)
_Must_inspect_result_ HRESULT WINAPI FilterVolumeFindNext(_In_ HANDLE hVolumeFind, _In_ FILTER_VOLUME_INFORMATION_CLASS dwInformationClass, _Out_writes_bytes_to_(dwBufferSize, *lpBytesReturned) LPVOID lpBuffer, _In_ DWORD dwBufferSize, _Out_ LPDWORD lpBytesReturned)
_Must_inspect_result_ HRESULT WINAPI FilterGetDosName(_In_ LPCWSTR lpVolumeName, _Out_writes_(dwDosNameBufferSize) LPWSTR lpDosName, _In_ DWORD dwDosNameBufferSize)
_Must_inspect_result_ HRESULT WINAPI FilterFindFirst(_In_ FILTER_INFORMATION_CLASS dwInformationClass, _Out_writes_bytes_to_(dwBufferSize, *lpBytesReturned) LPVOID lpBuffer, _In_ DWORD dwBufferSize, _Out_ LPDWORD lpBytesReturned, _Out_ LPHANDLE lpFilterFind)
_Must_inspect_result_ HRESULT WINAPI FilterFindClose(_In_ HANDLE hFilterFind)
HRESULT WINAPI FilterVolumeFindClose(_In_ HANDLE hVolumeFind)
static const WCHAR Message[]
_Must_inspect_result_ _Inout_ PFLT_VOLUME _In_ PCUNICODE_STRING Altitude
_Must_inspect_result_ HRESULT WINAPI FilterLoad(_In_ LPCWSTR lpFilterName)
_Must_inspect_result_ HRESULT WINAPI FilterUnload(_In_ LPCWSTR lpFilterName)
void PrintFilterInfo(_In_ PVOID Buffer, _In_ BOOL IsNewStyle)
void PrintVolumeInfo(_In_ PVOID Buffer)
void PrintErrorText(_In_ ULONG ErrorCode)
DWORD SetDriverLoadPrivilege()
void LoadAndPrintString(ULONG MessageId,...)
void LoadFilter(_In_ LPWSTR FilterName)
void UnloadFilter(_In_ LPWSTR FilterName)
_Check_return_opt_ _CRTIMP int __cdecl vwprintf(_In_z_ _Printf_format_string_ const wchar_t *_Format, va_list _ArgList)
_In_ NDIS_ERROR_CODE ErrorCode
_Check_return_ _CRTIMP int __cdecl _wcsicmp(_In_z_ const wchar_t *_Str1, _In_z_ const wchar_t *_Str2)
STRSAFEAPI StringCchPrintfW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszFormat,...)
STRSAFEAPI StringCchCopyW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_ ULONG _In_opt_ PWDF_MEMORY_DESCRIPTOR _In_opt_ PWDF_MEMORY_DESCRIPTOR _In_opt_ PWDF_REQUEST_SEND_OPTIONS _Out_opt_ PULONG_PTR BytesReturned
DWORD WINAPI GetLastError(void)
#define FORMAT_MESSAGE_FROM_SYSTEM
#define HRESULT_FROM_WIN32(x)
#define SE_LOAD_DRIVER_NAME
_Out_ PUNICODE_STRING DosName
#define TOKEN_ADJUST_PRIVILEGES
#define SE_PRIVILEGE_ENABLED